519265 - In Weave 0.7pre4 "My Account" page, setting password (even to same thing) locks me out of account

Status: RESOLVED FIXED

(Firefox :: Sync, defect, P1)

Description

[Daniel Holbert [:dholbert]]

STEPS TO REPRODUCE:
 1. Visit about:weave, and log in to Weave (if you haven't already)
 2. Click the "Signed in as [username]" menu, and choose "My Account"
 3. Click in the password field.
 4. Click the "Set" button that appears next to the password field.
 5. Sign out of Weave, and attempt to sign in.

EXPECTED RESULTS:
 Nothing should have changed. (You should still be able to log in with your old password.)

ACTUAL RESULTS:
 - My old password doesn't work anymore
 - The only way to get back in to your account (AFAICT) is to visit
     https://services.mozilla.com/pw/forgot.php
   and reset my password.

NOTE: The "Actual Results" are made scarier by the fact that the Weave UI's easily-discoverable "email me to reset my password" feature is currently broken. (bug 519262)

Comment 1

[Daniel Holbert [:dholbert]]

I'm using Weave 0.7pre4 on:
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.3a1pre) Gecko/20090928 Minefield/3.7a1pre

Comment 2

[Daniel Holbert [:dholbert]]

I've tried repeating the STR, and this time *modifying* the password before clicking "set".  I get the same problem -- locked out.  (The pre-entered password doesn't work, nor does my old password, nor does my new password.)

Comment 3

[Daniel Holbert [:dholbert]]

Attachment: screenshot: Weave @ Step 5 of STR, with unknown 15-char string in password field

One other thing I've noticed each time I've reproduced this bug: In step 5, when I attempt to sign in after having clicked "set" to change my password, it shows my pre-entered password as being a 15-character string (much longer than any of the passwords involved).  I'm not sure where these 15 characters come from.  Attaching a screenshot.

Comment 4

[Daniel Holbert [:dholbert]]

(I tried checking my Firefox "Saved Passwords" to investigate the 15-char string from comment 3, but that still shows my old Weave password as being the saved one.)

Comment 5

[Daniel Holbert [:dholbert]]

I just requested blocking-weave1.0, but IMHO this should block weave 0.7 -- the feature should be either disabled or fixed, because right now it's just a fun way for users to shoot themselves in the foot.

Comment 6

[Ed Lee :Mardak]

http://hg.mozilla.org/labs/weave/rev/543e896308c2
Set the password to the password input's value and not the jquery object. Do the same for passphrase.